LibreBooking on AWS User Guide

Overview

LibreBooking is a powerful open source, self-hosted scheduling and resource-reservation application, the actively maintained community fork of phpScheduleIt and Booked. Reserve rooms, equipment and any shared resource through a calendar, with groups, roles, quotas, approval workflows, blackout periods, custom reservation attributes, email and ICS notifications, and a full RESTful Web Services API. The cloudimg AMI delivers LibreBooking fully installed and configured as a LAMP application, so a complete booking system is running within minutes of launch, with all of your reservation data staying on your own server in your own AWS account. Backed by 24/7 cloudimg support.

LibreBooking is licensed under the GNU General Public License v3.0 (GPL-3.0). All product and company names are trademarks or registered trademarks of their respective holders. This image repackages the upstream open source release with cloudimg's provisioning and support.

What is included:

• LibreBooking 5.2.0 (GPL-3.0), served from /var/www/librebooking
• PHP 8.3 (php8.3-fpm) + MariaDB + nginx, with the booking calendar and admin backend on port 80 at the /Web/ path
• The RESTful Web Services API enabled at /Web/Services/index.php/
• A per-instance administrator password, MariaDB password and install password, all generated on first boot and written to a root-only file, so no default or shared login ships in the image
• The MariaDB data directory on a dedicated, independently resizable EBS data volume, separate from the OS disk
• mariadb.service, php8.3-fpm.service and nginx.service as systemd units, enabled and active, with MariaDB bound to loopback only
• 24/7 cloudimg support

Connecting to your instance

Connect over SSH as the default login user for the operating-system variant you launched. The user for each variant is:

ssh ubuntu@<instance-public-ip>

Prerequisites

An active AWS account, an EC2 key pair, and a VPC with a public subnet in the target region. m5.large (2 vCPU / 8 GiB RAM) is a good starting point; scale up for busier deployments. Security-group inbound: allow 22/tcp from your management network and 80/tcp (HTTP) from your users.

Step 1 - Subscribe on AWS Marketplace

Open the product's AWS Marketplace page, choose Continue to Subscribe, accept the terms, then Continue to Configuration. Select the fulfilment option (the LibreBooking AMI) and your Region, then Continue to Launch.

Step 2 - Launch the instance

From Launch through EC2, or the EC2 console Launch an instance from AMI, pick an instance type (m5.large or larger), your key pair, and a security group that allows SSH (22) from your management network and HTTP (80) from your users. The image declares a dedicated data volume for the MariaDB database in addition to the OS root volume; keep both when launching. Then Launch.

Step 3 - Connect to your instance

ssh ubuntu@<instance-public-ip>

Step 4 - Confirm the services are running

The three services that back LibreBooking should all report active. The bare root (GET /) redirects to the app under /Web/, and the login page answers HTTP 200 on port 80:

systemctl is-active mariadb php8.3-fpm nginx
curl -s -o /dev/null -w 'GET /      -> %{http_code} (redirect to /Web/)\n' http://127.0.0.1/
curl -s -o /dev/null -w 'GET /Web/  -> %{http_code} (login page)\n'       http://127.0.0.1/Web/

Expected: three lines of active, then GET / -> 302 and GET /Web/ -> 200. Only nginx on port 80 is exposed; php-fpm runs behind it and MariaDB listens on loopback (127.0.0.1) only.

Step 5 - Confirm the database is on its own data volume

The MariaDB data directory lives on a dedicated EBS volume, independently resizable and separate from the OS disk, so your reservation database can be grown or snapshotted on its own:

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/mysql

Expected: /var/lib/mysql is its own ext4 filesystem on a separate device from the OS root.

Step 6 - Retrieve your administrator password

On the first boot of every instance, a one-shot service (librebooking-firstboot.service) generates credentials that are unique to that instance: a fresh MariaDB password, a fresh administrator password and a fresh install password. It installs the application schema, creates the admin account and pins the application to your instance's own public address. No shared or default credentials ship in the image.

sudo cat /root/librebooking-credentials.txt

The file (mode 0600, root only) contains the administrator login (lb.admin.login, which is admin), the administrator password (lb.admin.pass), the install password (lb.install.password, which protects /Web/install), and the booking and API URLs.

Step 7 - Exercise the RESTful Web Services API

LibreBooking exposes a full REST API at /Web/Services/index.php/, enabled by default in this image. This reads the per-instance administrator password from the credentials file, authenticates to obtain a session token, and lists the bookable resources:

API=http://127.0.0.1/Web/Services/index.php
PW=$(sudo grep -m1 '^lb.admin.pass=' /root/librebooking-credentials.txt | cut -d= -f2-)
AUTH=$(curl -s -X POST "$API/Authentication/Authenticate" -H 'Content-Type: application/json' \
  -d "{\"username\":\"admin\",\"password\":\"$PW\"}")
TOKEN=$(echo "$AUTH" | jq -r .sessionToken)
USERID=$(echo "$AUTH" | jq -r .userId)
echo "authenticated: userId=$USERID"
curl -s -H "X-Booked-SessionToken: $TOKEN" -H "X-Booked-UserId: $USERID" "$API/Resources/" \
  | jq -c '.resources[] | {resourceId, name}'

Expected: authenticated: userId=1, then one JSON line per bookable resource (the two sample Conference Rooms). Authentication returns a sessionToken you pass in the X-Booked-SessionToken and X-Booked-UserId headers on every subsequent call.

cloudimg also ships a one-shot end-to-end check that authenticates, creates a reservation, reads it back, deletes it, and confirms an unauthenticated create is rejected with HTTP 401:

sudo /usr/local/sbin/librebooking-roundtrip.sh

Expected: ROUNDTRIP_OK ref=... resource=1 — proof the create then read-back reservation round-trip works end to end and that unauthenticated writes are refused.

Step 8 - Sign in to the web interface

Browse to http://<instance-public-ip>/ (it redirects to /Web/) and sign in with the login admin and the password from the credentials file.

After signing in you land on the dashboard, which shows your announcements and your upcoming and past reservations.

Step 9 - Book a resource and manage your resources

Open Schedule to see the booking calendar: a weekly grid of reservable time slots across your resources. Click a slot to create a reservation, choosing the resource, date, time, participants and any accessories. Reservations you make appear on the calendar and on your dashboard.

Two sample resources (Conference Room 1 and Conference Room 2) ship on the default schedule so you can begin immediately. Manage them from Application Management → Resources: add resources, set schedules and capacities, require approval, apply quotas, and grant permissions to groups and users.

Step 10 - Confirm the version and the security model

echo -n 'PHP     : '; php -r 'echo PHP_VERSION, "\n";'
echo -n 'schema  : dbversion '; sudo mysql -N -e 'SELECT version_number FROM librebooking.dbversion ORDER BY CAST(version_number AS DECIMAL(4,1)) DESC LIMIT 1'
sudo mysql -N -e "SELECT CONCAT('admin account: ', username, ' (', IF(password='70f3e748c6801656e4aae9dca6ee98ab137d952c','UPSTREAM DEFAULT - would be a problem','per-instance rotated - good'), ')') FROM librebooking.users;"

Expected: PHP 8.3.x, the schema version, and admin account: admin (per-instance rotated - good). LibreBooking's fresh install normally ships a well-known default administrator (admin / password); this image never ships it — the account is created fresh on first boot with a password unique to your instance, and the upstream default password hash is absent.

Step 11 - Add a custom domain and enable HTTPS

Point a DNS A record at your instance's public IP or Elastic IP. LibreBooking auto-detects its public URL from the request, so once you serve it over your domain the login and API links follow. To enable HTTPS, install a certificate with Certbot and add an nginx TLS server block:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains and installs the certificate and reloads nginx. If you pin a fixed public URL, set $conf['settings']['script.url'] in /var/www/librebooking/config/config.php to https://your-domain.example.com/Web.

Step 12 - Maintenance

• Application logs: LibreBooking writes to /var/log/librebooking/; nginx and php-fpm log under /var/log/nginx/ and /var/log/php8.3-fpm.log.
• Database backups: back up the librebooking MariaDB database with sudo mysqldump --single-transaction librebooking > librebooking-$(date +%F).sql, or snapshot the dedicated data volume with EBS snapshots or AWS Backup.
• OS updates: unattended-upgrades is enabled, so security updates are applied automatically. Apply all updates with sudo apt-get update && sudo apt-get -y dist-upgrade.
• Config: application settings live in /var/www/librebooking/config/config.php (self-registration is disabled and the API is enabled by default).

Security model

• No default credentials. The admin account and the MariaDB user are created on first boot with passwords unique to each instance, written to /root/librebooking-credentials.txt (mode 0600, root only). The upstream default admin / password login never ships.
• Loopback database on a dedicated volume. MariaDB binds to 127.0.0.1 only and its data directory lives on a dedicated EBS volume; nothing but nginx on port 80 is exposed publicly.
• Self-registration disabled and install protected. Open self-registration is turned off and /Web/install is protected by a per-instance install password.
• Rotate the administrator password from My Account after first sign-in, and restrict 22/tcp to your management network.

Support

This image is backed by 24/7 cloudimg support. Contact us for help with deployment, resources and schedules, groups, roles and quotas, approval workflows, email and ICS notifications, the RESTful API, user management, database tuning, TLS and scaling.